Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!

Notices

Welcome to LinuxQuestions.org, a friendly and active Linux Community.

You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!

Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.

If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.

Having a problem logging in? Please visit this page to clear all LQ-related cookies.

Introduction to Linux - A Hands on Guide

This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.

Well, there is not a simple command to recover deleted files/folders. First of all it would be safer if you can umount the disk/partition to which the deleted folder belongs: this should prevent overwriting the disk sectors where the deleted folder is located. Then you need a recovery program like photorec/testdisk.

If the folder is located under the / partition (root) and you cannot umount it, better to run a LiveCD suite and install photorec/testdisk from there. Good luck!

SystemRescueCD is a Linux live CD that has photorec already installed. I recently used it to recover some deleted files on a LUKS-encrypted LVM partition, and it worked fine.

The problem you are likely to have is that photorec can only recover files, not folders, and it doesn't recover meta-data like the original file names. It just searches free space on the disk for recognizable data. You'll need a different disk or partition for it to write the discovered files to. It creates directories named recup_dir.n where n is 1, 2, 3, etc., and puts hundreds of files in each one. It creates file names like f0127440.<extension> where <extension> is its best guess as to the file type, such as txt, c, h, java, xml, zip, etc.

If the disk you are trying to recover data from has been in use for a while, it's likely that photorec will find tens of thousands of files that it will organize into hundreds of folders with hundreds of files in each. Once you have that, you'll need to examine those files somehow (e.g., grep) to find the ones you're interested in. If the files you deleted were changed repeatedly, it's likely you'll find multiple revisions of each, and you'll have to try to figure out which version of the file to save.

If all the files you are trying to recover are of some easily recognizable type that photorec recognizes, you can limit its search to just those type files, which will greatly reduce the number of files you have to search through. Even so, you will likely end up with a lot of files to sift through in order to find the ones you want to save. It becomes a data reduction task of potentially enormous magnitude. It is not a trivial task, and it is likely to take a lot of time and effort.

photorec is a good recovery tool if you really have no other option, but it is better to take regular backups of your data so that you can just restore from the most recent backup.